Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
bd9a3bc50f3ecfc434b0028f3ded4491fa735e837623f268c7bbf4adf0ccf3e9.zip
-
Size
584KB
-
Sample
220913-13ptjsgff9
-
MD5
aedf7cb991a3bcac931e9288546b377e
-
SHA1
27fefa1ae02596f8a454fd5076427b3f657313ee
-
SHA256
e2cb0508f1aae0f0b83d62d137f9b488c82dce051e13b8545fd04d7c29a7bde4
-
SHA512
0f438ff33cec0ec39a5d74506137ce7286d07b5c13b14e7f41ad27bec489cb1407677f0da8c8f35e7a9ea425a66bdd80a81b10fc31b72d6de122dfc5c82fcf0d
-
SSDEEP
12288:AqVP7/1qcEbLl5ipgjKUrBcNf3JLPaaurGwDk9oL6pxR/S6VuiK:AqVj/1qcEPipTy8flPLuawDYoLmxRasK
Static task
static1
Behavioral task
behavioral1
Sample
bd9a3bc50f3ecfc434b0028f3ded4491fa735e837623f268c7bbf4adf0ccf3e9.exe
Resource
win10v2004-20220901-en
Malware Config
Extracted
Protocol: smtp- Host:
mail.rimiapparelsltd.com - Port:
587 - Username:
[email protected] - Password:
Ijeomam28@
Extracted
agenttesla
Protocol: smtp- Host:
mail.rimiapparelsltd.com - Port:
587 - Username:
[email protected] - Password:
Ijeomam28@ - Email To:
[email protected]
Targets
-
-
Target
bd9a3bc50f3ecfc434b0028f3ded4491fa735e837623f268c7bbf4adf0ccf3e9.exe
-
Size
891KB
-
MD5
1179dd8e427142d60d82f588fcdb2138
-
SHA1
03cb870e3ba8994943709b0f6c15bde9ebe20d04
-
SHA256
bd9a3bc50f3ecfc434b0028f3ded4491fa735e837623f268c7bbf4adf0ccf3e9
-
SHA512
cc4cb1d1291fce22a637722c47a92f78e5bba894fe6cd3429189bc3807b4d8bd52b55c104ce51f07b8995663167555b08e037bdb3b6ceb17ab0b58ecb9e765fc
-
SSDEEP
12288:DUx1l4E2P1dzsCBW/T9smPym20WJ5oxswsJ42//1NjoIHN:gt4E2P1dzsCqRXWLox5sXnfkk
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-